fix(native-chat): one ordered journal writer

[brennanb2025]

	Files	Added	Deleted	Net
Test	31	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1488	$\color{#cf222e}{\Huge{\mathbf{−}}}$​328	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1160
Prod	43	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​702	$\color{#cf222e}{\Huge{\mathbf{−}}}$​373	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​329

ELI5

A structured chat's history is written to one journal. Two kinds of writes go into it: what the agent streams (its turn starting and ending, its items), and what Orca itself records (a message accepted, a Stop's note, a settlement). The streamed kind used to wait in a separate line of its own before reaching the journal, and Orca's own writes skipped that line. So when both happened close together, they could land in the wrong order: a message could flicker back to "working" after it had settled, a Codex rejection could land before the turn end that caused it, and a Stop's note could attach to the wrong turn. Now there is one line for everything, and every write lands in the order it happened.

What Changed

The problem.

• Streamed provider events waited in the event sink's own queue, one operation at a time, before they reached the chat's journal write queue. About 25 host paths wrote the journal directly and skipped that wait. Order between the two was right only while the sink happened to be idle. What that looked like:
  • Claude: a send's settlement landed ahead of the turn event that proved it (fix(native-chat): Stop is there from the moment a message is sent #23026's flicker: the chat read working again after it had settled).
  • Codex: a rejection landed ahead of the turn end that caused it, and an acceptance ahead of the echo that proved it.
  • The Stop note and the handover read the journal while earlier writes were still waiting, so they picked the wrong turn.
• Ten places patched this with flushStreamedEvents() before writing. That's a guard at each site, not one order.
• Closing the sink threw away writes it still held.
• Coalescing moved a rewritten write to the back of the line, behind writes issued after it.

Scope. Structured Claude and Codex chats, on the desktop app, paired clients and SSH hosts: the host owns the journal. Nothing on the wire changes, and nothing new is saved. Terminal agents aren't affected.

Before / After

Case	Before	After
Claude settles a send while earlier streamed rows are still waiting	the settlement lands first; the chat can read working again	lands after the turn that proved it
Codex rejects or accepts a send while earlier streamed rows are still waiting	lands ahead of the turn end or echo	lands after it
The sink closes with writes already handed over	the ones still waiting were lost	they land
A streamed reply's row is rewritten after another row	moved behind that row	stays in place

Mechanism

• One rule, stated on JournalWriteQueue: a write has landed in the fold when its call returns, except during an owed import, when it lands in queue order. Every journal write body is already synchronous (a transaction refuses to await), so an idle queue now runs it before serialize returns. It chains only while an owed legacy import is being paid, or when a write is issued from inside a running write; that one runs after, never nested.
• The event sink stops being a queue (structured-agent-session-event-sink-queue.ts). Once bound, each operation is handed to the journal queue in the same tick. While unbound (during attach), operations buffer in order and are handed over at bind. Backpressure counts what was admitted and hasn't settled, at the same thresholds. Closing drops only never-bound buffered operations.
• Journal-write coalescing is removed. A publication (a live update with no row) now also goes out in the same tick once the sink is bound; it waits and coalesces only behind an owed import. Subscribers see the same number of updates, because the host's commit listener already coalesces per microtask (measured on a 20-command Codex turn: 84 vs 83 publishes). Measured with the real Claude and Codex translators on a 40,000-character reply sent as 2,000 deltas: rows were identical in three of four cases. The worst case, a whole Codex reply in one burst, went from 28 to 41 rows (+6% bytes, about 2 ms).
• The ten flush patches are deleted. With the rule, the fold is current where those sites read it. Kept as real barriers, because they wait for the unbound buffer: attach, eviction, unexpected exit, the quit barrier and rewind. Rewind now reads the current sink, so a failed sink still cached no longer fails a rewind.
• A Stop always interrupts (structured-agent-session-chat-stop.ts, structured-agent-session-queued-stop.ts). Withdrawing queued sends and recording the queue pause are issued before the interrupt, not awaited ahead of it. If either write throws (for example on SQLite damage), that's reported and counts as nothing withdrawn, and the interrupt still goes out. The Stop decides from the fold as it stands.
• A Stop holds the chat until its queue pause lands, even when the interrupt or its note fails. Otherwise the queue drain could run first, read "not paused" and send a waiting card after the Stop.
• When a Stop also ends Claude's process (the kill step that runs after the interrupt), the kill is issued before the queue pause has landed, and the Stop keeps holding the chat until the pause lands. Flush calls that came back with that change (the mutation context, prompt cancel) are removed under the same rule.
• Every mutation opens the chat after an owed legacy import (structured-agent-session-send-preparation.ts openConversationForWrite), as readers already did. So a Stop, a goal set or /clear reads a fold that holds every provider row written before it. A failed import is reported and the mutation goes ahead rather than being refused: every write before it has already settled.
• A journal write body is typed synchronous (JournalWriteBody on JournalWriteQueue.serialize). An async body no longer compiles, so the rule can't be broken silently.

Audit: code and tests that relied on a write landing after its call returned

• Changed:
  • rejectJournalQueuedSubmissions issues its rejections together.
  • Four Stop tests now expect a failed withdrawal or pause to be reported, not to fail the Stop: queued-withdrawn-draft, queued-pause-lift, stop-never-waits and journal-write-queue.
  • The test subscriber in append-delivery now awaits its opening snapshot; it used to get it only because writes landed late.
  • Two translator tests that relied on journal-write coalescing.
  • The sink's backlog helper and its close and backpressure tests, and resolved-append, now run over a real owed import instead of delayed mocks.
• Unaffected:
  • Readers that await a write and then read the fold: they read the same fold, sooner.
  • The commit listener already defers its work to a microtask, so an immediate commit can't re-enter it.
  • About 17 tests using await Promise.resolve()/setImmediate: they pass unchanged.

Why

The common pattern reaches one order per chat with two queues: agent events wait in a queue of their own, which the host's own writes skip. Orca has no network hop between the agent and the journal, and its journal commits were already synchronous, so it reaches the same outcome with one queue: the per-chat journal write queue. The second queue ahead of it, and the microtask gap the queue added itself, are what made order depend on timing. Removing both gives one rule every caller can rely on, instead of a flush at each site.

Alternatives considered:

• Route every direct write through the sink. That gives the same order, but every host mutation would then depend on a bound sink, and callers that need a result would await it through the sink: more moving parts for the same property.
• Keep an async queue and make readers "read in order" (a read that waits behind queued writes). This was built first and then replaced as the general rule after an architecture review. It needed four caller rules (read in order here, read the fold there, a "still landing" check for Stop, flushes elsewhere), and nothing caught a new site that read too early. Committing synchronously removes all of that. readInOrder itself remains for one case: a live update (no row) issued while an old chat's history import is still owed, so it goes out behind the writes waiting on that import.
• Coalesce in place inside the journal queue. Not built: the measurement showed coalescing isn't material.

Differences from the common pattern

• Intended: one queue instead of two. Agent output reaches the journal queue in the same tick it arrives, and the host's own writes go through the same queue. Orca has no network hop between the agent and the journal, so one synchronous queue gives the same single order with fewer moving parts; Orca orders a chat by write sequence (which crash recovery relies on), so a provider event handed over later than a host row would land after that row, and the same-tick hand-off closes that gap.
• Intended: closing the sink lands every write already handed over. A handed-over write is the record of something that already happened; before this PR, closing threw away the ones still waiting.
• Intended: a Stop doesn't wait on its own withdraw, pause and Stop-event writes before interrupting. The common pattern writes its stop record first and sends no stop if that write fails. Orca reports the failure and interrupts anyway, because bookkeeping never gates a user action; the Stop still holds the chat until those writes land. A follow-up makes this a synchronous write in a try/catch that logs, then the interrupt, once the item below is gone.
• Temporary: writes chain while an owed legacy import is paid. Old chats are copied into the shared journal lazily, which feat(native-chat): one structured-chat journal database per host, owned by one process #23613 already labels temporary; until a chat is copied, its writes land in queue order behind that copy, and readInOrder and the owed-import wait at a mutation's open exist only for it. Follow-up: copy an old chat when it is first read (startup restore copies the chats it restores), so nothing is ever owed; that removes the owed state, readInOrder, the waiting publication path and the open's import wait.

Linked Issue

No issue. Found while fixing #23026's settlement flicker, which a flush patch covered at one site.

Visual Proof

Live QA on the M4 Air with the real Claude CLI, on ea165f4 and on main at its merge parent (d3f8c50), run hidden through the dev tools protocol. That head still carried a first-text row write that was dropped afterwards to match the common pattern; none of these scenarios depends on it, because each Stop is pressed after the text is on screen, when its row already exists (main behaved the same in every run). No AI driver seat was available (the Grok seat was out of balance and no DeepSeek model was offered), so the scenarios were run as scripts with in-page watchers.

Stop 2.5 s into a streamed reply: the note is below the text, the turn reads "Interrupted", and Claude's process ends.

The next message resumes the same conversation: Claude quotes the first line of the poem it was stopped in.

Stop pressed as the first text appears, 3 runs: the note is below the text every time, on screen and in the journal.

A second message sent while Claude streams, then Stop: it is never sent, and its text comes back to the composer.

Stop pressed twice quickly: one note, no error.

Short replies settle and never flip back to working.

After quitting and relaunching the app on the same profile, the transcript reads in the same order.

Not tested live: Codex, the owed legacy-import paths, and the retry after a Stop whose exit can't be confirmed (it can't be produced from the app).

Testing

• I manually tested these changes (live QA on the M4 Air, above)

• Automated tests added/updated, or explained why not below

• Red on the code before this PR, green after:

  • Claude settlement order (claude-echo-working);
  • Codex rejection and acceptance order (new structured-agent-session-codex-settlement-order);
  • the Stop note's turn (turns);
  • close with writes already handed over (event-sink);
  • a rewritten row keeps its place (event-sink);
  • a rewind after a failed sink (rewind).

• The rule, on the real queue with a real owed import (journal-write-queue):

  • a write is in the fold when its call returns on an idle queue;
  • it lands in queue order behind an owed import;
  • a write issued from inside a running write runs after it, never nested;
  • a throw comes back as a rejection.

• The Stop, on the real host (stop-never-waits), for a Stop naming no turn and one naming its turn: it interrupts when withdrawing throws, when recording the pause throws, and with owed work queued ahead of its writes.

• A Stop whose note fails under owed work keeps the card waiting under a 'stopped' pause, with no hand-off (queued-pause-lift).

• A Stop that ends Claude's process kills it before its withdrawal or pause settles, for both Stop kinds (stop-never-waits, "ends a session-ending provider's child before … settles").

• Under an owed import with provider rows queued: a Stop naming no turn interrupts, a goal set replaces the goal in the running turn, and a failed import still lets the Stop answer (new structured-agent-session-mutation-owed-import).

• A publication replaced after it was handed over is skipped, and the count returns to 0 (event-sink).

• Ablations, each run and restored:

  • always chaining fails every rule and Stop test;
  • no catch on the withdrawal fails both withdrawal Stop tests;
  • nested writes fail both re-entrancy tests;
  • holding in the sink fails the four settlement-order tests;
  • tail coalescing fails "keeps a rewritten row in its place";
  • dropping at close fails the close test.

• A full named run of every agent-session-wire and agent-session-journal test, plus the structured, subagent, compact and streamed tests under claude, codex and runtime (no real-CLI files): 376 files, 3,355 of 3,358 passed. The 3 failures were structured-chat-coordinator-mail (a known load flake) and refusal-retry (a load timeout). Both pass alone.

• After the review fixes and main merges: 282 named files, 3,110 passed (the readiness-census transcript tests are excluded; they fail on main too).

• tc:node, tc:cli and oxlint pass.

AI Disclosure

Review

• Architecture challenge: it found that the first design's read-in-order and its Stop special cases were papering over a delay the queue created itself. That design was replaced by synchronous commit.
• Review loop on the first design: clean at P0 to P2. Its P3s were folded in: a bound-publication test, rewind's barrier, and marking flushStreamedEvents test-only. Tracing its coalescing-window point turned up the Stop-note reorder fixed here.
• Review loops on this head: six rounds plus narrow reviews of each Stop-path merge, the last clean at P0 to P2. They added the Stop holding the chat until its pause and Stop event land, the synchronous write-body type, and mutations waiting for an owed import. A review against comparable hosts then dropped a first-text row write this PR had added: it closed a 60 ms window the common pattern also leaves open, with no failure observed in Orca, at +33% to +50% journal commits on tool-heavy turns.

Agent skill upstream boundary

• Not applicable, or this change follows docs/reference/agent-skill-sharing-upstream-boundary.md and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

Built on #23898, now merged; this branch has main merged in, so the diff is only this change.

Known limits:

• A host row written in a streamed text block's first 60 ms (a Stop's note, a message sent while the agent works) can land above that block's text, which then appears below it. The common pattern leaves the same window open; the text isn't on screen yet when it happens.
• An owed legacy import (a chat still in an older build's per-chat file, copied into the database on first read or write) can be owed while the agent runs: attaching starts the agent before the copy. Provider rows then wait behind the copy, so every read and every mutation waits for it first, and each sees them. Every UI client reads a chat before it can act on it, so in practice the copy is done before any Stop. The owed-import paths are pinned by tests anyway.
• If that one-time copy fails, it's reported and the Stop still interrupts. If it hangs, an API or CLI Stop on a never-read legacy chat waits for the copy before interrupting. The UI can't reach this: a chat whose copy hangs never renders. The code before this PR behaves the same.
• If that one-time copy failed when the chat opened and its retry then hangs, a Stop that ends Claude's process kills it only after its note is written; the interrupt still goes out first. Before this PR the interrupt and the kill both waited.
• In the same narrow state (the copy failed at open and its retry is still running when Stop is pressed), the Stop can read a chat whose only pending work is a queued message as working: it may then show "had no turn running to stop", or a Codex Stop whose interrupt failed may end the process. Removing that state, so a failed copy is settled at open instead of retried by every later write, is a follow-up.
• A Stop whose note is waiting behind a write that never settles holds the session lane, so a second Stop waits for it. The first Stop's interrupt has already gone out.

Follow-ups:

• Copy an old chat when it is first read, so no import is ever owed (removes the Temporary item above), then make the Stop's bookkeeping a synchronous write in a try/catch before the interrupt.

Same on macOS, Linux, Windows and SSH hosts: the host owns the journal.

Checklist

• This PR is small and focused (74 files: the queue, the sink, the ten deleted flush sites, the Stop path, and the tests that pinned the old timing)
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

Author: @BrennanKB5

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 7410a01c-bc6f-47fb-a900-a2430bbc2f89

📥 Commits

Reviewing files that changed from the base of the PR and between 052e6a9 and ea165f4.

📒 Files selected for processing (52)

• src/main/claude/claude-structured-journal-translation-background-tasks.test.ts
• src/main/claude/claude-structured-journal-translation.test.ts
• src/main/claude/claude-structured-session-reading-control.test.ts
• src/main/claude/claude-subagent-roster.test.ts
• src/main/codex/codex-structured-journal-goal-resume.test.ts
• src/main/codex/codex-structured-journal-translation-settlement.test.ts
• src/main/codex/codex-structured-journal-translation.test.ts
• src/main/codex/codex-subagent-roster.test.ts
• src/main/native-chat/agent-session-journal/journal-epoch-controller.ts
• src/main/native-chat/agent-session-journal/journal-open.ts
• src/main/native-chat/agent-session-journal/journal-queued-messages.ts
• src/main/native-chat/agent-session-journal/journal-store-collaborators.ts
• src/main/native-chat/agent-session-journal/journal-store.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-append-delivery.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-chat-stop.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-claude-echo-working.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-claude-unproven-stop-send.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-codex-stop-row.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-conversation-stop.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-queue.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-delivery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-mutation-admission.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-mutation-context.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-mutation-owed-import.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-prompt-cancel.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-message-rig.test-fixture.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-pause-lift.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-stop.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-wiring.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-withdrawn-draft.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-resolved-append.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-rewind.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-stop-never-waits.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-turns-cancel.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command.ts
• src/main/runtime/structured-agent-session-codex-settlement-order.test.ts

💤 Files with no reviewable changes (10)

• src/main/native-chat/agent-session-wire/structured-agent-session-queued-wiring.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-mutation-admission.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-mutation-context.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-rewind.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-delivery.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The journal write queue now supports synchronous write bodies, ordered reads, and appends resolved inside the queue. The event sink hands operations directly to the journal, tracks their settlement, and replaces keyed publications instead of coalescing writes. Streamed-text handling attempts an immediate first emission and uses scheduled windows for later snapshots. Session mutation and Stop paths change how they order journal reads, imports, cancellation, queued-send withdrawal, and queue pauses.

Priority: ⬆️ High

Merge Risk: 🟡 Moderate · up to ea165

A Stop during legacy-chat import can miss newly received running-turn state and leave generation continuing until another operation intervenes. Restore ordered mutation reads before merging, or explicitly accept this bounded regression.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to ea165

The ordering changes improve normal operation, but Stop can still make its decision while received work remains queued. That creates a bounded risk of an agent continuing after a stop request; broader permission or cross-session exposure has not been established.

Retained concerns

• Medium · reliability · inferred: An unnamed Stop can classify a live session as idle while its provider turn-start remains queued. The import wait covers earlier queue positions, not all provider rows admitted afterward; Stop then reads the fold directly and can choose the branch that omits interruption. Compared with the base sink barrier, this weakens the ordering boundary protecting user cancellation. The concern applies when the fold has neither an active turn nor an unanswered dispatch and queued lifecycle work has not landed. Normal synchronous commits and rows preceding the import wait are covered. Continued agent activity would use existing session authority; no privilege escalation is established.

Security review details

Security Blast Radius

• inferred — The identified ordering risk is independently scoped to a conversation and its provider child. Any continued work inherits that session's existing authority; the inspected flow does not establish cross-session access or the downstream assets available to the provider.

Security Findings and Attack Paths

• inferred — Provider-event timing can leave received lifecycle state behind the fold used by an authorized Stop. If that fold reads idle, Stop can answer without calling cancellation. This is a cancellation-control concern, not a verified attacker exploit or an identity-boundary bypass.

Trust Boundaries and Controls

• observed — Attach and mutations share session serialization. Attach binds and drains its sink before adopting the provider child; unsuccessful attempts close their own sink. This counters the separate concern that ordinary Stop execution overlaps an attach attempt's unbound buffer.

Resilience and Maintainability Implications

• observed — When working state is already visible, Stop issues interruption without waiting for its own withdrawal or event bookkeeping, then holds the mutation lane for completion. Focused tests cover bookkeeping failures, but the import-order test places the provider row before the import wait and does not resolve the later-admission interval.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 46.99% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 83 functions across 70 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise, specific, and accurately summarizes the main change: consolidating journal writes into one ordered writer.
Description check	✅ Passed	The description is comprehensive and covers the required explanation, mechanism, rationale, testing, visual proof, limitations, and checklist. It references issue #23026 but the Linked Issue section s…

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pullfrog]

✅ No new issues found.

Reviewed changes

I read the full 78-file diff and traced the production paths behind it: the synchronous write queue, the pass-through event sink, the delta coalescer's first-delta write, and the Stop/import call sites. No defects found; two independent probes (queue ordering/accounting, and first-delta text handling) also came back clean.

• One synchronous journal write rule — JournalWriteQueue.serialize now runs a synchronous body before returning on an idle queue and chains only behind an owed import or a running write; JournalWriteBody<T> makes an async body a compile error.
• The event sink stops being a queue — submit hands each operation to the journal at submit and buffers only while unbound; publications carry a publicationKey and are superseded only while still waiting, while journal writes never coalesce. close()/fail() drop only never-bound operations, so writes already handed over still land.
• Ten flushStreamedEvents barriers deleted — replaced by the "lands when its call returns" invariant, with real barriers kept for attach, eviction, unexpected exit, teardown and rewind.
• A streamed item takes its row at its first non-empty delta — the coalescer emits a stream's first text immediately (opening), and the window only delays later in-place snapshots; costs one extra row per streamed item.
• A Stop no longer waits on bookkeeping — withdrawal and queue-pause are issued together, failures are reported rather than fatal, and a failed Stop still holds the session lane until its pause lands; isMainAgentWorking reads the fold synchronously.
• Every mutation's open pays an owed import first — openConversationForWrite awaits a pending legacy import so a Stop, goal set or /clear reads a whole fold.

  ^{｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

This run reviewed the new head 19cc13b, a merge of origin/main (07e9fdfd) into the branch. The merge reported conflicts in five host/delivery files, so the incremental scope is that conflict resolution.

• Child-work reads threaded through command and mutation paths — the command handover context, delivery-loop deps, mutation context and host construction sites now carry the host's child records, and conversationCommandBlocked is called with them (main's #22614).
• Close-of-chat delivery handling preserved — closeWhatTheUserClosed / abandonQueued and the user-close end cause (main's #24232) are wired alongside this branch's synchronous delivery loop.
• Journal-ordering invariants intact — the branch's removal of flushStreamedEvents barriers and its synchronous isMainAgentWorking survive the merge; the only remaining production flushStreamedEvents reference is the host test barrier.

Verification: pnpm tc:node is clean, and structured-agent-session-turns, structured-conversation-command-admission and structured-agent-session-command-readers pass (28 tests). A specialist read of all five conflict files found no dropped branch change, no dropped main behavior, and no inconsistent wiring.

  ^{｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

This run reviewed the delta since the prior Pullfrog review at 19cc13bc: a merge of origin/main (2a83c9536f) into the branch at be2a130, whose only conflicts were in structured-conversation-command.ts and its controller.

• Merged current origin/main into the branch — seven main commits, including /clear starts nothing (#23935), at-rest model listing (#24267), and the daemon-protocol / Node-runtime CI gates.
• Re-applied the branch's flush removal on main's rewritten /clear — the resolution drops host and flushStreamedEvents from runStructuredConversationCommand and the controller's host pick, so main's new sendPreparation → commitConversationClear flow runs under this branch's synchronous-write invariant. The two files' net PR diff is now exactly that removal.
• Main's new at-rest/delivery hooks and /clear tests landed intact — watchAtRestCommands, readCommands via client delivery, the newSession start-failure cause, and the added /clear replacement assertion auto-merged with no branch change dropped.
• Journal-ordering invariants survive the merge — grep flushStreamedEvents finds only test call sites plus the host test barrier at structured-agent-session-host.ts:256.

Verification: pnpm tc:node is clean. The branch's ordering headline tests (structured-agent-session-streamed-text-order, structured-agent-session-codex-settlement-order, structured-agent-session-stop-never-waits, journal-write-queue) pass (33 tests), and structured-conversation-command + structured-agent-session-queued-messages pass (54 tests). No open Pullfrog review threads to retire.

  ^{｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to GitHub limitations.

⚠️ Outside diff range comments (4)

🟠 Major · Order the Stop working-state read through the… · structured-agent-session-turns-cancel.ts:18-25

src/main/native-chat/agent-session-wire/structured-agent-session-turns-cancel.ts:18-25
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Order the Stop working-state read through the journal queue.

For an unnamed chat Stop with an attached running child, this interleaving can occur:

1. The journal owes an import.
2. The provider sink accepts the running-turn operation and queues its journal write behind the import no-op.
3. openConversationForWrite() resumes when the import no-op settles, before the provider write runs.
4. The Stop reads isMainAgentWorking() synchronously and sees no active turn.
5. The Stop returns without interrupting the provider.

The withdrawal call does not prevent this. The Stop issues withdrawal before the read but does not await it before selecting the no-interrupt branch.

Make isMainAgentWorking() use journal.readInOrder() and await it at both callers.

Suggested fix

-export function isMainAgentWorking(
+export function isMainAgentWorking(
   ctx: Pick<AgentSessionTurnContext, 'journal' | 'fence'>
-): boolean {
-  return isStructuredAgentSessionMainAgentWorking(
-    ctx.journal.activeTurnId(),
-    ctx.journal.submissions(),
-    ctx.fence
-  )
+): Promise<boolean> {
+  return ctx.journal.readInOrder(() =>
+    isStructuredAgentSessionMainAgentWorking(
+      ctx.journal.activeTurnId(),
+      ctx.journal.submissions(),
+      ctx.fence
+    )
+  )
 }

-      const inFlight = turnId !== undefined || isMainAgentWorking(ctx)
+      const inFlight = turnId !== undefined || (await isMainAgentWorking(ctx))

-    if (!cancelled && (await input.withdrewQueued) === true && !isMainAgentWorking(ctx)) {
+    if (!cancelled && (await input.withdrewQueued) === true && !(await isMainAgentWorking(ctx))) {

🟡 Minor · Order the goal read after queued provider writes. · structured-agent-session-thread-goal.ts:55-60

src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.ts:55-60
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Order the goal read after queued provider writes.

When import completion has queued whenImported()’s no-op, a provider goal operation can be accepted before the await continuation runs. The provider write then remains queued after the no-op, while this direct threadGoal() read runs first and returns null. replacesGoal can therefore become false, so the adapter receives a non-replacement request despite the accepted provider goal.

Read the goal through ctx.journal.readInOrder(...); waiting for import completion alone does not order provider writes admitted during that completion.

Suggested fix

-    replacesGoal = ctx.journal.threadGoal() !== null
+    replacesGoal =
+      (await ctx.journal.readInOrder(() => ctx.journal.threadGoal())) !== null

🟡 Minor · Order the shared command-admission read before… · structured-conversation-command.ts:90-100

src/main/native-chat/agent-session-wire/structured-conversation-command.ts:90-100
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Order the shared command-admission read before checking blockers.

An accepted provider operation can queue its running-turn or prompt row after the import barrier and before the command handler reads the journal. The direct conversationCommandBlocked call can therefore see no blocking row and admit the command while provider work is active.

Command handover uses the same helper, so it has the same race. Its later snapshot checks do not provide an ordering barrier and can observe the same stale journal state.

Make conversationCommandBlocked obtain its snapshot and submissions through one journal.readInOrder() call. Make both callers await that shared helper. One shared correction fixes conversation-command admission and command handover; separate blocking logic is not required.

🟡 Minor · Order the drain gate behind accepted provider… · structured-agent-session-queued-messages.ts:316-339

src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.ts:316-339
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Order the drain gate behind accepted provider writes.

step() reads structuredQueueHold directly. An accepted provider operation can still be absent from that read. The drain then consumes the draft and wakes delivery.

prepare() only stops for a running conversation command. It does not stop for an active ordinary turn or a pending prompt. After awaitStarted(), handOver() rechecks only the child identity and queued submission. The ordinary branch of handOverSubmission then records dispatch: pending and calls the adapter without re-reading the hold.

The queued ordinary message can therefore dispatch while the provider turn or prompt remains pending. Ordering conversationCommandBlocked does not fix this path because the ordinary-message branch does not call that helper.

Suggested fix

-    const next = oldestActionableQueuedMessage(journal)
+    const gate = await journal.readInOrder(() => {
+      const next = oldestActionableQueuedMessage(journal)
+      const record = this.deps.getRecord(sessionId)
+      const fence = this.deps.conversationFence(sessionId)
+      return {
+        next,
+        fence,
+        hold: next === null ? null : structuredQueueHold({ journal, record, fence })
+      }
+    })
+    const { next, fence } = gate
     if (!next) {
       return
     }
-    const record = this.deps.getRecord(sessionId)
-    const fence = this.deps.conversationFence(sessionId)
     // Live facts only, through the one gate; the backlog is never a gate, so a
     // lone draft drains. Whatever clears a hold publishes or commits, which
     // re-derives this step.
-    if (structuredQueueHold({ journal, record, fence }) !== null) {
+    if (gate.hold !== null) {
       return
     }

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 68acf39d-fb84-4ba9-930b-9b61c6008277

📥 Commits

Reviewing files that changed from the base of the PR and between 19cc13b and e62687f.

📒 Files selected for processing (13)

• src/main/claude/claude-open-turn.ts
• src/main/claude/claude-structured-prompt-ownership.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-chat-stop.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-conversation-stop.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-mutation-context.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-prompt-cancel.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-prompt-cancel.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-stop-never-waits.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-turns-cancel.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command-controller.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command.ts

💤 Files with no reviewable changes (3)

• src/main/native-chat/agent-session-wire/structured-agent-session-mutation-context.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• src/main/claude/claude-structured-prompt-ownership.ts
• src/main/claude/claude-open-turn.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🔎 Supported by static analysis

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- prompt cancel diff ---'
git diff d4ae6a904beb552ea195332747025b01879844ea e62687ff9fba57f4eed9ff4b20fec0beeaa31d7a -- src/main/native-chat/agent-session-wire/structured-agent-session-prompt-cancel.ts src/main/native-chat/agent-session-wire/structured-agent-session-prompt-state.ts
printf '%s\n' '--- prompt cancel source ---'
cat -n src/main/native-chat/agent-session-wire/structured-agent-session-prompt-cancel.ts
printf '%s\n' '--- prompt state source ---'
cat -n src/main/native-chat/agent-session-wire/structured-agent-session-prompt-state.ts
printf '%s\n' '--- dismissal and callers ---'
rg -n -C 8 'dismissPrompt|cancelStructuredAgentSessionPrompt|validate.*Prompt|validated' src/main/native-chat/agent-session-wire
printf '%s\n' '--- preparation and sink ---'
cat -n src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts | sed -n '1,130p'
cat -n src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-queue.ts | sed -n '150,235p'
printf '%s\n' '--- journal queue ---'
cat -n src/main/native-chat/agent-session-journal/journal-write-queue.ts
printf '%s\n' '--- journal store ---'
cat -n src/main/native-chat/agent-session-journal/journal-store.ts | sed -n '160,300p'

Repository: stablyai/orca

Length of output: 43109

---

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- append and guards ---'
cat -n src/main/native-chat/agent-session-journal/journal-store.ts | sed -n '297,390p'
cat -n src/main/native-chat/agent-session-journal/journal-write-guards.ts
rg -n -C 8 'resolution|appendItem|terminal|revision|cancel|dismissPrompt' src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire | head -n 500
printf '%s\n' '--- provider lifecycle operations ---'
rg -n -C 12 'kind:.*terminal|terminal|turn.*end|revision|appendItem' src/main/native-chat/agent-session-wire src/main/native-chat/agent-session-adapters | head -n 600
printf '%s\n' '--- prompt cancellation tests ---'
rg -n -C 15 'cancelStructuredAgentSessionPrompt|prompt.*cancel|dismissPrompt|routePromptCancel' src --glob '*test*' --glob '*spec*' | head -n 600
printf '%s\n' '--- mutation preparation and dispatch ---'
rg -n -C 12 'openConversationForWrite|sendPreparation|prepare|mutation' src/main/native-chat/agent-session-wire/structured-agent-session* | head -n 500

Repository: stablyai/orca

Length of output: 45659

---

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- item appender definitions ---'
rg -n -C 20 'class .*ItemAppender|appendResolved|itemAppender|JournalResolvedItem' src/main/native-chat/agent-session-journal
printf '%s\n' '--- append resolved usages ---'
rg -n -C 18 'appendResolvedItem|appendResolved' src/main/native-chat
printf '%s\n' '--- event operation append paths ---'
rg -n -C 12 'appendItem\(|appendLifecycleBatch\(|append.*turn|state: .completed|state: .interrupted|resolution:.*state' src/main/native-chat/agent-session-wire --glob '*.ts' --glob '!*.test.ts'
printf '%s\n' '--- prompt cancel wiring ---'
rg -n -C 20 'cancelStructuredAgentSessionPrompt|routePromptCancel|dismissPrompt' src/main/native-chat/agent-session-wire --glob '*.ts' --glob '!*.test.ts'

Repository: stablyai/orca

Length of output: 42494

---

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- row builder and append resolution ---'
rg -n -C 24 'function journalItemRowBuilder|const journalItemRowBuilder|journalItemRowBuilder|revision' src/main/native-chat/agent-session-journal/journal-row-builders.ts src/main/native-chat/agent-session-journal/journal-reducer.ts src/main/native-chat/agent-session-journal/journal-item-appender.ts
printf '%s\n' '--- non-test item writes ---'
rg -n -C 8 'appendItem\(' src/main/native-chat --glob '*.ts' --glob '!*.test.ts'
printf '%s\n' '--- prompt lifecycle names ---'
rg -n -C 12 'promptCancelled|cancelledPrompt|cancel.*prompt|prompt.*cancel|kind: .approval.|kind: .question.' src/main/native-chat --glob '*.ts' --glob '!*.test.ts'
printf '%s\n' '--- event sink operation declarations ---'
rg -n -C 20 'type .*Operation|interface .*Operation|operation:|run:.*bound|run\(bound' src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-queue.ts src/main/native-chat --glob '*.ts' --glob '!*.test.ts' | head -n 800

Repository: stablyai/orca

Length of output: 43109

---

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- resolved revision call sites ---'
rg -n -C 30 'tryReviseResolvedItem|tryAppendResolvedItem|tryAppendLifecycleTransition' src/main/native-chat --glob '*.ts' --glob '!*.test.ts'
printf '%s\n' '--- prompt bodies and provider event mapping ---'
rg -n -C 20 'kind: .approval.|kind: .question.|resolution:|selectedOptionId|turnScope' src/main/native-chat/agent-session-adapters src/main/native-chat/agent-session-wire --glob '*.ts' --glob '!*.test.ts' | head -n 1000
printf '%s\n' '--- cancellation mutation flow ---'
cat -n src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts | sed -n '1,145p'
cat -n src/main/native-chat/agent-session-wire/structured-agent-session-mutation-context.ts | sed -n '1,110p'

Repository: stablyai/orca

Length of output: 42535

---

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- exact resolved-revision files ---'
rg -l 'tryReviseResolvedItem|tryReviseResolvedItemAndPublish|tryAppendLifecycleTransition' src --glob '*.ts' --glob '!*.test.ts'
printf '%s\n' '--- exact call-site excerpts ---'
for f in $(rg -l 'tryReviseResolvedItem|tryReviseResolvedItemAndPublish|tryAppendLifecycleTransition' src --glob '*.ts' --glob '!*.test.ts'); do
  echo "--- $f"
  rg -n -C 18 'tryReviseResolvedItem|tryReviseResolvedItemAndPublish|tryAppendLifecycleTransition' "$f"
done
printf '%s\n' '--- event sink bindings ---'
rg -n -C 15 'createStructuredAgentSessionEventSink|createStructuredAgentSessionResolvedAppend|eventSink|bind\(.*journal|bind.*journal' src/main/native-chat --glob '*.ts' --glob '!*.test.ts'

Repository: stablyai/orca

Length of output: 41876

---

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- Claude turn revision implementation and callers ---'
cat -n src/main/claude/claude-turn-row-revision.ts | sed -n '145,230p'
rg -n -C 18 'writeClaudeTurnRow\(' src/main/claude src/main/native-chat --glob '*.ts' --glob '!*.test.ts'
printf '%s\n' '--- stop mutation path ---'
cat -n src/main/native-chat/agent-session-wire/structured-agent-session-chat-stop.ts | sed -n '1,180p'
printf '%s\n' '--- ordered-read usages near mutation validation ---'
rg -n -C 12 'readInOrder\(' src/main/native-chat/agent-session-wire --glob '*.ts' --glob '!*.test.ts'

Repository: stablyai/orca

Length of output: 23591

---

Order prompt validation after admitted provider writes.

When openForWrite waits for an owed import, a provider terminal revision can be accepted and queued behind that import. The preparation can then return before the revision updates the fold. Prompt cancellation can therefore see the old live turn, call routes.stop(), and withdraw queued submissions even though the provider has already ended that turn.

Use an ordered journal read for prompt validation.

Suggested fix

-  const validated = validatePendingPrompt(ctx, input.prompt)
+  const validated = await ctx.journal.readInOrder(() => validatePendingPrompt(ctx, input.prompt))

[pullfrog]

Important

The merge adopted main's new Stop path but replaced its flushed fold read with the branch's direct read, which can observe a stale fold while a legacy import is owed. Details inline.

Reviewed changes

This run reviewed the delta since the prior pullfrog review at be2a130: a merge of origin/main (d4ae6a904b) into the branch at e62687ff.

• Merged current origin/main into the branch — main's #24235 (a Claude Stop ends its child on the session lane, question/tool/plan card Cancel routed through the provider, new structured-agent-session-chat-stop.ts and structured-agent-session-mutation-context.ts), #24299 (sidebar host-pill toggle), #24071 (test tick) and the README badge.
• Re-applied the one-ordered-writer invariant onto main's Stop path — structured-agent-session-chat-stop.ts drops main's isMainAgentWorkingOnceFlushed flush for the branch's synchronous isMainAgentWorking, and the deferred-withdrawal / pause-after-end design is layered on; prompt-cancel.ts drops main's flushStreamedEvents() drain; host-mutations.ts shrinks to a type re-export with the admit-then-serialize path moved to mutation-context.ts.
• Main behavior survived the merge — card-cancel routing, the 3 s grace, and the stop-ends-session tests are intact; the branch's stop-never-waits / conversation-stop tests grew the session-ending-provider and owed-import cases. flushStreamedEvents has no production caller; only the host test barrier remains.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

After openConversationForWrite awaits the owed legacy import, provider rows admitted during that import are still queued behind it, so this direct isMainAgentWorking(ctx) read can see a fold with no running turn — a Stop naming no turn then declines to interrupt. Main's #24235 flushed the sink at this read (isMainAgentWorkingOnceFlushed); dropping it for the open's import await narrows the guarantee from "every row admitted before the read" to "every row admitted before the open." The same stale read applies at the other mutation read sites.

Technical details

# A mutation's fold read can miss provider rows admitted during an owed import

## Affected sites
- `structured-agent-session-chat-stop.ts:86` — `isMainAgentWorking(ctx)` selects the no-interrupt branch on a possibly stale fold.
- `structured-agent-session-turns-cancel.ts:131` — `!isMainAgentWorking(ctx)` decides whether a withdrawn Stop ended what it was sent for.
- `structured-agent-session-thread-goal.ts:60` — `ctx.journal.threadGoal()` decides `replacesGoal`.
- `structured-conversation-command.ts:92` — `conversationCommandBlocked(...)` admits `/clear`.
- `structured-agent-session-queued-messages.ts:328-339` — `oldestActionableQueuedMessage` / `structuredQueueHold` gate the drain.

## Why
- `whenImported()` is `queue.serialize(() => undefined)` (`journal-store.ts:195`). With an owed import it joins via `join(run, paysOwed=true)` (`journal-write-queue.ts:110-119`), chaining on the `this.writes` in hand at that instant. A provider write handed over later chains on the post-join `this.writes`, so it settles after `whenImported()` resolves and its body runs after the mutation's `await` continuation — which then reads a fold missing it.
- Reachable: a read-restore open defers the import (`structured-agent-session-read-restore.ts:39-41`) and `conversationDelivery.open` short-circuits an already-indexed session (`structured-agent-session-conversation-open.ts:69-72`); `bindAndDrain` binds the sink and completes without waiting for the import (`structured-agent-session-attach-orchestration.ts:190,270-281`) whenever nothing was buffered. A client attach on such a session lets the live child stream rows while the import is still owed.
- The existing `structured-agent-session-mutation-owed-import.test.ts` issues its provider rows *before* the mutation, so they are upstream of `whenImported` and land in time; the test passes whether or not this gap exists.

## Required outcome
- A mutation's post-open reads observe every provider row admitted before the read, not merely before the open.

## Suggested approach
- Take these reads at their place in the journal queue via `journal.readInOrder(...)` (`journal-store.ts:274`, `journal-write-queue.ts:52`), which joins behind already-admitted writes; make `isMainAgentWorking` return that promise and await it at both call sites. Pin it with a case that emits a provider row after the mutation starts, while the import is still owed.

## Open questions for the human
- Is the owed-import window intended to carry the weaker per-open guarantee (as the class comments now say), or the per-read one the old flush gave?

[pullfrog]

ℹ️ No new issues found in this delta. The changes are a merge of origin/main and its conflict resolution; main's new work survives intact under the branch's synchronous-write invariant.

Reviewed changes

This run reviewed the delta since the prior pullfrog review at e62687ff: a merge of origin/main (7176648759, the re-land of #23916 "every chat action press is its own action" plus the SSH/relay/orcad work) into 052e6a93, whose only conflicts were in structured-agent-session-prompt-cancel.ts and structured-conversation-command.ts.

• Merged current origin/main into the branch — main's repeat-press work (answerFromCommittedClear, committedClearOfCaller, answerCancelOfSettledPrompt, STOP_NOTE_CANCELLATION_REQUESTED, note = null when a named turn ended nothing) and the interleaved SSH/relay/orcad commits are now in the branch, which added no new feature commits of its own.
• Re-applied the one-ordered-writer invariant on the new Stop/Cancel code — the resolution drops flushStreamedEvents() from cancelStructuredAgentSessionPrompt and performCancel, drops main's post-flush re-validatePendingPrompt, and removes host / flushStreamedEvents from runStructuredConversationCommand and its controller, so main's new routes run under the "a write has landed when its call returns" rule.
• No main behavior dropped — git diff 7176648759..052e6a93 over the touched files shows only those flush removals; repeat-press routing and the card-cancel paths are intact.

Verification: structured-agent-session-prompt-cancel, -prompt-cancel-repeat, -turns and structured-conversation-command pass (49 tests).

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[greptile-apps]

Failed withdrawal skips queue pause
If a Stop reaches no active agent and withdrawal fails after rejecting a queued submission, withdrewAny is false, so this branch does not pause the queue. The released draft can then be sent automatically under a fresh ID, even though the user pressed Stop. The rejections are separate writes, so one can land before another fails.

[pullfrog]

ℹ️ No new issues found in this delta. The changes are a merge of origin/main — a large orcad/SSH/relay/daemon batch plus native-chat Stop fixes — and its 13-file conflict resolution; main's new Stop behavior survives under the branch's synchronous-write invariant.

Reviewed changes

This run reviewed the delta since the prior pullfrog review at 052e6a93: a merge of origin/main (d3f8c506, ~70 commits) into the branch at ea165f40, whose conflicts were in 13 files.

• Merged current origin/main into the branch — a large batch of orcad/SSH/relay/daemon/runtime work plus the native-chat Stop fixes #24072, #24333, #24334, #24437 and #24312 are now in the branch, which added no feature commits of its own.
• Re-applied the one-ordered-writer invariant on main's rewritten Stop path — main's event-based runRecordedStop / appendStopEvent (the queue pause is derived from the Stop event) replaces the branch's queue-pause step; the branch issues the withdrawal (withdrawQueuedForStop) and the Stop event (effect) without awaiting ahead of the interrupt, holding the lane via eventAfterEnd; isMainAgentWorking stays synchronous across chat-stop.ts, queued-stop.ts and turns-cancel.ts, and performCancel now takes the withdrawal as a Promise<boolean>, reading working before awaiting it.
• Main Stop behavior survived the merge — interruptFailed / stillRunsStoppedTurn / childReleased / onStopChildError (#24334, #24333) and the event-derived pause (#24072) are intact, and flushStreamedEvents has no production caller (the host test barrier remains).
• Test conflicts resolved — the Claude/Codex tests adopt the branch's helpers (withJournalQueueMembers, testEventSinkLogging); the event-sink, resolved-append and turns tests use the real journal; two main Stop tests (codex-stop-row, claude-unproven-stop-send) drop their journal-hold simulation and a duplicate drained mock because writes are now synchronous.

Verification: pnpm tc:node is clean, and 9 ordering files (134 tests) pass, including structured-agent-session-codex-stop-row, -stop-never-waits, -queued-stop-row, -event-sink, -claude-unproven-stop-send and journal-write-queue.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues found in this delta. This run reviewed the merge of origin/main and its single conflict resolution; main's new work survives intact under the branch's synchronous-write invariant.

Reviewed changes

This run reviewed the delta since the prior Pullfrog review at ea165f40: a merge of origin/main (9e34bd06, ~70 commits) into the branch at 575193b, whose only conflict was structured-agent-session-chat-stop.ts.

• Merged current origin/main into the branch — main's Stop-event work #24311 (journal-stop-marks.ts with personStopDecides, journal-stop-turn-end.ts, structured-agent-session-host-stop-event.ts, a new structured-session registry, and the journalStopDecidesTurn sink pass-through) plus a large orcad / SSH / relay / daemon / runtime batch. The branch added no feature commits of its own.
• Re-applied the one-ordered-writer invariant on main's rewritten Stop body — the resolution keeps the branch's deferred withdrawal (withdrawQueuedForStop, with hadQueued read before issuing), the synchronous isMainAgentWorking read, the eventAfterEnd lane hold, and the withdrewQueued: Promise<boolean> handover, while adopting main's stopChild({ recorded: 'user-stop' }) and the stopEndsSession event-naming rule (a session-ending Stop names the live turn, or none). stopReachesUnrecordedWork is now called synchronously, matching main.
• Main Stop behavior survived the merge — the Stop event is still issued before the interrupt and any child end, so the new turn-end personStopDecides read sees it, and eventAfterEnd holds the lane for a session-ending Stop. isMainAgentWorkingOnceFlushed is gone from the tree; flushStreamedEvents has no production caller (the host test barrier remains).

Verification: pnpm tc:node clean, oxlint clean on the conflict file, and 147 tests pass across structured-agent-session-stop-never-waits, -event-sink, -stop-event-binding, -stop-event-entries, -stop-event-restart, -claude-stop-turn-end, -claude-stop-ends-session, -codex-stop-row, structured-agent-session-codex-settlement-order, -streamed-text-order, -mutation-owed-import, and journal-write-queue.

The earlier owed-import read-staleness finding remains open and is not re-raised here.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues found in this delta. This run reviewed the revert of the immediate first-delta write; the one-ordered-writer, sink hand-off and Stop rules are untouched, and the earlier owed-import read-staleness finding remains open.

Reviewed changes

This run reviewed the delta since the prior Pullfrog review at 575193b: one authored, non-merge commit a18b3e8d that reverts the first-text row write the branch had added.

• Reverted the coalescer's immediate first-delta emit — agent-session-delta-coalescer.ts returns to main's behavior: the opening flag, the changed/emits counters, the forced row-creating flush and the four-argument emit are gone, so a stream writes only on its window snapshot.
• Reverted the translators and checkpoints onto main's coalescer contract — claude-streamed-text-checkpoints.ts and codex-structured-item-streams.ts call emit with three arguments, and the coalescer, translator and checkpoint tests that pinned the first-text row return to main's expectations.
• Deleted the window-ordering test — structured-agent-session-streamed-text-order.test.ts, which only exercised the removed first-text guarantee, is removed; no config or suite references it.
• The feature is otherwise intact — for these eleven files the net diff against the PR base (9e34bd06) is empty except the branch's existing journal-write-coalescing removal in codex-structured-item-streams.ts and the test-helper adoption in the Codex translator test, so the ordered-writer, synchronous Stop and owed-import paths are unchanged. The author documents the re-opened 60 ms window as a known limit.

Verification: the four reverted unit suites pass (77 tests), and structured-agent-session-integration's "joins final deferred writes before runtime teardown completes" passes with the restored pre-spy delta.

The earlier owed-import read-staleness finding remains open and is not re-raised here.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}